Lead Palo Alto Networks Device Security Engineer

REQUIREMENT SUMMARY

- Role: Lead Palo Alto Networks Device Security Engineer – Specialist Level II

- End Client: CUNY – Computing and Information Services

- Location: 395 Hudson Street, 6th Floor, New York, NY 10014 (Hybrid: minimum 2 days onsite per week, rest remote)

- Positions: 1

- Duration: 12 months

- Anticipated Start: Around November 5, 2026

- Hours: 8 AM – 5 PM EST, 40 hours/week

PROJECT OVERVIEW

CUNY is implementing and operationalizing Palo Alto Networks Device Security across its distributed environment to strengthen device discovery, inventory, visibility, risk assessment, policy development, integration and operational resilience. The engineer will own end-to-end delivery: planning, dependencies, risks, governance, stakeholder coordination, architecture support, platform configuration, device discovery and classification, inventory enrichment, integrations, policy recommendations, testing, troubleshooting, production validation, operational transition and adoption, working with central teams and stakeholders across 25 colleges.

KEY RESPONSIBILITIES

• Lead hands-on configuration and operationalization of Palo Alto Networks Device Security through Strata Cloud Manager
• Coordinate device discovery, classification, inventory enrichment, risk assessment, policy recommendations, segmentation requirements and validation
• Configure and validate integrations with NGFWs, Panorama, Prisma Access, Cortex XDR, Cortex XSOAR, SIEM, ITSM and other authorized systems
• Analyze device and network telemetry; troubleshoot discovery and integration issues; manage resolution and escalation
• Coordinate with cybersecurity, network, infrastructure, operations and vendor teams across 25 colleges
• Prepare architecture, configuration, integration, test, operating-procedure, status, governance and handoff documentation
• Provide knowledge transfer and support phased rollout, production validation, adoption and transition to operations

TECHNICAL ENVIRONMENT

Palo Alto Networks Device Security via Strata Cloud Manager (inventory, Query Builder, policy recommendations, risk assessment), Next-Generation Firewalls, Panorama, PAN-OS, Prisma Access, GlobalProtect, Cortex XDR, Cortex XSOAR, XQL, Device Security APIs and integration connectors, Wireshark, ServiceNow, PowerShell, Python, REST APIs, Postman, MS Project, Visio, Git, Teams, SharePoint.

MANDATORY QUALIFICATIONS (Pass/Fail – the resume must clearly show each of these)

1. Implementation engineering: At least one completed production device-security, IoT/OT-security or network-based asset-discovery implementation as technical lead or primary implementation engineer, with platform, scope, responsibilities, outcome and a client/employer reference.

2. Device Security engineering: Hands-on configuration and operation of Palo Alto Networks Device Security through Strata Cloud Manager, covering device discovery, profiling, classification, inventory enrichment, risk assessment, policy recommendations and production validation.

3. Palo Alto platform: Configuration and troubleshooting of PAN-OS, Panorama and NGFWs, including traffic visibility, device telemetry, policy validation and segmentation support.

4. Integration: Integration with enterprise systems such as Cortex XDR, Cortex XSOAR, Prisma Access, SIEM, ITSM, APIs, connectors or asset-information sources.

5. Testing and troubleshooting: Diagnosis and resolution of discovery gaps, classification errors, telemetry issues, connector failures, API errors, duplicate/inconsistent device records and production-readiness defects.

6. Automation and data analysis: Use of APIs, PowerShell, Python, Postman, XQL, Git or similar for data extraction, integration, validation, reporting or repeatable engineering tasks.

7. Technical program delivery: Ownership of integrated schedules, dependencies, risks, issues, change control, stakeholder coordination, status reporting and decision tracking.

8. Documentation and knowledge transfer: Architecture diagrams, configuration records, integration procedures, test evidence, operating procedures, troubleshooting guides and KT materials produced by the candidate.

9. Certifications (scored, not pass/fail): Current Palo Alto Networks, networking, IoT/OT, security or PM certifications are a strong plus; copies required if claimed.

WHAT TO SUBMIT

- Updated resume (tailored to the mandatory qualifications above)

- Short project narrative for the primary Device Security / IoT-OT / asset-discovery implementation

- Copies of certifications claimed

- Two professional references (at least one client/employer from the cited implementation)

- Candidate full name, current location, work authorization, availability/notice period

- Confirmation the candidate can work onsite at 395 Hudson St, NYC at least 2 days a week

- Best all-inclusive hourly rate

- Candidate must be willing to undergo background screening as directed by CUNY